MS-102 Practice Test 44 — 15 Questions

Question 1

Drag and drop the steps to configure role-based access control (RBAC) in Microsoft 365 Defender in the correct order.

Accepted Answer

Create or edit RBAC roles in Microsoft 365 Defender, then assign permissions to the roles, then assign the roles to users or groups.. RBAC roles are created/edited in Defender, permissions assigned, and then assigned to users/groups.

Answer

Assign permissions to the roles, then create or edit RBAC roles, then assign the roles to users or groups.

Answer

Create or edit RBAC roles, then assign the roles to users or groups, then assign permissions to the roles.

Answer

Assign the roles to users or groups, then create or edit RBAC roles, then assign permissions to the roles.

Question 2

Match each Microsoft 365 Defender portal component to its function.

Accepted Answer

Incidents: A collection of related alerts that represent a potential attack.. The correct matches are Incidents with 'collection of related alerts', Alerts with 'individual notifications', and Hunting with 'proactive search'. The definitions for Threat Analytics and Secure Score are swapped in options C and D.

Answer

Threat Analytics: A measurement of an organization's security posture.

Answer

Secure Score: Provides expert analysis of active threats and campaigns.

Question 3

Which TWO actions can you perform using Microsoft Purview Data Loss Prevention (DLP) policies?

Accepted Answer

Show a policy tip to users when they attempt to share sensitive data.. Option B is correct because Microsoft Purview DLP policies can display policy tips to users in supported apps (for example, Outlook, Word, Excel, and SharePoint) when their actions match a DLP rule, warning them before they share sensitive data. Option C is correct because DLP policies can enforce blocking actions, such as preventing users from sending emails containing sensitive information like credit card or Social Security numbers, via Exchange/Outlook and other workloads. Option A is not a DLP function; retention periods are configured with retention labels and retention policies in Microsoft Purview Data Lifecycle Management (or records management), not DLP. Option D is not a DLP action; watermarks are applied through sensitivity labels with content marking (or Azure Information Protection), not DLP policies. Option E is not a DLP action; automatic encryption is achieved through sensitivity labels with encryption settings, not DLP, which focuses on detecting and restricting/blocking sharing rather than encrypting files.

Answer

Set retention periods for documents containing credit card numbers.

Answer

Add a watermark to sensitive documents.

Answer

Automatically encrypt sensitive files when shared.

Question 4

Your organization needs to manage guest access to Microsoft Teams. Which TWO methods can you use to control guest access?

Accepted Answer

Enable guest access in the Teams admin center.. Enabling guest access in the Teams admin center is a required step to allow guest users to join Teams. Without this toggle enabled, guest access is blocked at the Teams level regardless of other settings. This setting works in conjunction with Microsoft Entra ID external collaboration settings to control guest access.

Answer

Use sensitivity labels to restrict guest access.

Answer

Configure SharePoint Online external sharing settings.

Answer

Set conditional access policies for guest users.

Question 5

Match each Microsoft 365 role to its administrative scope.

Accepted Answer

Global Administrator: Full access to all administrative features. These roles are part of Microsoft Entra ID role-based access control. The correct matches are: Global Administrator (full access), User Administrator (users/groups), Exchange Administrator (Exchange settings). Common confusions include mixing Global and User Administrator scopes, or User and Exchange Administrator scopes.

Answer

Global Administrator: Manage only user accounts and licenses

Answer

User Administrator: Manage email settings and policies

Answer

Billing Administrator: Manage security and compliance policies

Question 6

You are a Microsoft 365 administrator for a multinational company. The security team reports that a large number of failed sign-in attempts are originating from unexpected IP ranges. The company uses Microsoft Entra ID for identity. What should you configure to automatically block these malicious sign-ins?

Accepted Answer

Create a Conditional Access policy to block access from those IP ranges. A Conditional Access policy can explicitly block sign-ins from specific IP ranges. By creating a policy that targets all users or specific users and includes a condition for the named location (the unexpected IP ranges), you can automatically deny authentication requests from those addresses at the Entra ID level, effectively blocking malicious sign-ins before they reach any application.

Answer

Enable Security defaults in the tenant

Answer

Configure Identity Protection user risk policy to block high-risk users

Answer

Enable Azure AD Multi-Factor Authentication for all users

Question 7

You are reviewing a Conditional Access policy in JSON format. The policy is applied to all users accessing Office 365 from trusted locations. What is the intended behavior of this policy?

Accepted Answer

Users must provide MFA or use a compliant device. The policy grants access when users are in a trusted location and either provide MFA or use a compliant device. The 'OR' condition between MFA and device compliance means that satisfying either requirement is sufficient, not both. This is the standard behavior when multiple controls are assigned with 'Require one of the selected controls' in Conditional Access.

Answer

Users are blocked if they are not using a compliant device

Answer

Users must provide MFA and use a compliant device

Answer

Users only need to provide MFA regardless of device

Question 8

A company uses Microsoft Entra ID P2 licenses and wants to enforce multi-factor authentication (MFA) for all users when accessing corporate applications. However, a small group of break-glass accounts must be excluded from MFA requirements to ensure emergency access. The administrator creates a Conditional Access policy targeting all users. Which configuration should be applied to achieve the exclusion?

Accepted Answer

Under 'Assignments' > 'Users and groups', select 'Exclude' and choose the security group containing break-glass accounts.. Conditional Access policies in Microsoft Entra ID allow administrators to exclude specific users or groups from policy enforcement. By excluding the security group containing break-glass accounts under 'Assignments' > 'Users and groups', the MFA requirement is applied to all other users while ensuring emergency access accounts remain unblocked. This is the standard and recommended approach for handling break-glass accounts in a Conditional Access policy targeting all users.

Answer

Set 'Grant' control to 'Require multi-factor authentication' and include all users including break-glass accounts.

Answer

Under 'Session' controls, configure 'Sign-in frequency' with a value of 0 to disable MFA for break-glass accounts.

Answer

Create a separate policy for break-glass accounts that does not impose MFA and assign it a lower priority.

Question 9

A global administrator wants to track service health issues and configure notifications for service incidents. Which portal should they use to view the current health status and set up email notifications?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center provides the Service Health dashboard under Health > Service Health, which displays the current status of all Microsoft 365 services and allows administrators to configure email notifications for service incidents. This is the designated portal for managing tenant-wide service health and notifications, aligning with the role of a global administrator.

Answer

Azure portal

Answer

Microsoft 365 Defender portal

Answer

Microsoft Purview compliance portal

Question 10

A company has purchased 1000 Microsoft 365 E5 licenses and wants to automatically assign licenses to users based on their department attribute, which is synchronized from on-premises Active Directory. The department attribute is stored in Azure AD. Which automated method should the administrator use to achieve this?

Accepted Answer

Group-based licensing with dynamic groups. Group-based licensing with dynamic groups is the correct method because it allows automatic license assignment based on user attributes like department, which is synchronized from on-premises Active Directory via Microsoft Entra Connect. Dynamic groups evaluate membership rules in Microsoft Entra ID, and when a user's department attribute matches the rule, the group-based licensing policy automatically assigns or removes the Microsoft 365 E5 license without manual intervention.

Answer

scheduled PowerShell script that runs daily

Answer

Manual license assignment via the Microsoft 365 admin center

Answer

Bulk assign licenses using the admin center import feature

Question 11

A company recently acquired another company and needs to allow users from the acquired tenant to access its SharePoint Online sites as guest users, but only if those users already have accounts in the acquired Azure AD tenant. Which Microsoft 365 feature should be configured?

Accepted Answer

Cross-tenant access settings for B2B collaboration. Cross-tenant access settings for B2B collaboration allow you to configure inbound and outbound access between two Microsoft Entra ID tenants. By enabling B2B collaboration with the acquired tenant and setting the appropriate cross-tenant access policies, you can invite users who already have accounts in that tenant as guest users to access SharePoint Online sites. This ensures that only authenticated users from the acquired tenant are granted access, meeting the requirement.

Answer

B2B direct connect

Answer

Multi-Geo

Answer

Tenant Restrictions

Question 12

A security administrator wants to prevent users from uploading files to unsanctioned cloud storage apps (e.g., personal Dropbox or Google Drive) from managed Windows devices. The solution must use a reverse proxy to control file uploads in real time. Which Microsoft Defender for Cloud Apps feature should the administrator configure?

Accepted Answer

Session policy. Session policy in Microsoft Defender for Cloud Apps uses reverse proxy capabilities to monitor and control user activities in real time. When configured with the 'Control file upload' action, it can block or restrict uploads to unsanctioned cloud storage apps like personal Dropbox or Google Drive from managed Windows devices, meeting the requirement exactly.

Answer

App discovery policy

Answer

Access policy

Answer

Activity policy

Question 13

A ransomware alert is confirmed in Microsoft Defender XDR on a user device that is still communicating with other endpoints. What should the administrator do first to reduce spread while preserving the ability to investigate?

Accepted Answer

Isolate the affected device from the network. Immediately isolating the affected device from the network stops the ransomware from spreading laterally to other endpoints via SMB, RDP, or other protocols, while preserving the device's state for forensic analysis. Microsoft Defender XDR's device isolation feature blocks all inbound and outbound communication except with the Defender for Endpoint cloud service, allowing investigation to continue without the risk of further infection.

Answer

Collect a forensic package before taking containment action

Answer

Run a full antivirus scan before isolating the device

Answer

Wait for automated investigation to complete before responding

Question 14

A newly hired administrator needs to manage user accounts, licenses, and reset passwords. Which portal should they access?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center (admin.microsoft.com) is the primary portal for day-to-day user administration tasks such as creating and managing user accounts, assigning licenses, and resetting passwords. It provides a unified interface for these common identity and license management operations within a Microsoft 365 tenant.

Answer

Microsoft Entra admin center

Answer

Microsoft 365 Defender

Answer

Azure Active Directory admin center

Question 15

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a user's device establishes a network connection to a known malicious IP address on a port commonly used by a specific malware. The rule must also include process information such as the filename of the process that initiated the connection. Which advanced hunting table should be the primary data source for this rule?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft Defender XDR captures network connection events, including source and destination IP addresses, ports, and the initiating process's filename and ID. This makes it the ideal primary data source for a custom detection rule that must trigger on a specific malicious IP and port combination while also providing process information.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

IdentityLogonEvents